Group Policy for Setting Passwords: Server 2003 Domain

You don't mention whether you're working with a Windows 2003 Active Directory or a Windows 2008 Active Directory.

In a Windows 2003 Active Directory all domain user accounts are subject to the resultant account policy from GPOs applied at the root of the domain. You can't have some accounts with different password policies (expiry, length, lockout settings, etc). (Local user accounts on non-domain controller computers can have different password policies, but domain users all fall under the same domain password policy).

In Windows 2008 Active Directory, when set to a Windows 2008 functional level, you can have "granular" password policies. Microsoft didn't implement this with Group Policy, though. Rather, a new type of Active Directory object is used. Here's an article re: granular password policy to get you started, if you can use them: http://technet.microsoft.com/en-us/library/cc770394(WS.10).aspx

If you're stuck at Windows 2003 Active Directory the only method to have different password policies for a subset of users is to create another domain and put the accounts in that domain.

By default, users will be able to log on fine, and won't be forced to change their passwords straight away. When their password is next due for renewal then they will need to supply a password of the correct complexity at that time.

You can of course set the 'change password at next logon' flag on all accounts now if you want people to change their passwords as soon as possible. Depending on your situation this might be useful though obviously rather disruptive too; if you tell people about the new rules now but some of them don't have to change their passwords for another 60 days then they'll probably have forgotten about the new complexity rules by then.

If you want everyone to have a complex password then make sure that all passwords are set to expire so that they have to change them.